cve.bz

OWASP A05:2025 Injection vulnerabilities, newest first, page 113

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A05:2025 at MITRE.

Its weaknesses: 37

CWE-20, CWE-74, CWE-76, CWE-77, CWE-78, CWE-79, CWE-80, CWE-83, CWE-86, CWE-88, CWE-89, CWE-90, CWE-91, CWE-93, CWE-94, CWE-95, CWE-96, CWE-97, CWE-98, CWE-99, CWE-103, CWE-104, CWE-112, CWE-113, CWE-114, CWE-115, CWE-116, CWE-129, CWE-159, CWE-470, CWE-493, CWE-500, CWE-564, CWE-610, CWE-643, CWE-644, CWE-917

  1. 5.9CVE-2026-81380EPSS 0.7%

    Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.

  2. 7.2CVE-2026-81349EPSS 1.0%

    Improper neutralization of special elements used in an os command ('os command injection') in Azure HDInsights allows an authorized attacker to elevate privileges over a network.

  3. 8.8CVE-2026-78518EPSS 0.9%

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

  4. 8.8CVE-2026-78463EPSS 0.9%

    Improper control of generation of code ('code injection') in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

  5. 8.8CVE-2026-77908EPSS 1.0%

    Improper control of generation of code ('code injection') in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network.

  6. 8.2CVE-2026-76191EPSS 0.2%

    Animate is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability …

  7. 7.8CVE-2026-73021EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  8. 7.8CVE-2026-72996EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  9. 7.8CVE-2026-72994EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  10. 6.5CVE-2026-72977EPSS 1.0%

    Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.

  11. 7.8CVE-2026-70581EPSS 0.3%

    Integer overflow or wraparound in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  12. 7.0CVE-2026-70573EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  13. 9.8CVE-2026-69845EPSS 1.0%

    Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network.

  14. 7.8CVE-2026-69821EPSS 0.3%

    Improper encoding or escaping of output in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges locally.

  15. 7.0CVE-2026-69806EPSS 0.8%

    Exposure of sensitive information to an unauthorized actor in .NET allows an authorized attacker to elevate privileges locally.

  16. 8.8CVE-2026-69716EPSS 1.0%

    Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

  17. 5.4CVE-2026-69690EPSS 0.4%

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

  18. 6.5CVE-2026-69636EPSS 1.0%

    Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.

  19. 4.8CVE-2026-69615EPSS 0.4%

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

  20. 8.8CVE-2026-69614EPSS 0.9%

    Stack-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.

  21. 7.8CVE-2026-69534EPSS 0.3%

    Improper neutralization of special elements used in a command ('command injection') in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.

  22. 5.4CVE-2026-69417EPSS 0.4%

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

  23. 5.4CVE-2026-69402EPSS 0.4%

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

  24. 9.3CVE-2026-69356EPSS 0.8%

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

  25. 7.8CVE-2026-69352EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  26. 7.8CVE-2026-69295EPSS 0.3%

    Out-of-bounds read in Windows USB Driver allows an authorized attacker to elevate privileges locally.

  27. 7.8CVE-2026-69293EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  28. 5.5CVE-2026-69286EPSS 0.4%

    Out-of-bounds read in Windows USB Audio Class driver (usbaudio.sys) allows an authorized attacker to disclose information locally.

  29. 7.8CVE-2026-69270EPSS 0.3%

    Heap-based buffer overflow in Windows USB Audio Class driver (usbaudio.sys) allows an authorized attacker to elevate privileges locally.

  30. 9.8CVE-2026-68839EPSS 1.0%

    Heap-based buffer overflow in Windows USB Mass Storage Class Driver allows an unauthorized attacker to execute code over a network.

  31. 8.8CVE-2026-67370EPSS 1.0%

    Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

  32. 8.8CVE-2026-66820EPSS 1.0%

    Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

  33. 8.8CVE-2026-66819EPSS 1.0%

    Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

  34. 9.6CVE-2026-65669EPSS 0.9%

    Improper neutralization of special elements in output used by a downstream component ('injection') in SQL Server allows an unauthorized attacker to elevate privileges over a network.

  35. 8.8CVE-2026-62895EPSS 0.8%

    Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker to elevate privileges over a network.

  36. 5.5CVE-2026-54611EPSS 0.7%

    InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution (RCE) issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possibl…

  37. 2.1CVE-2026-86668EPSS 0.5%

    A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.15. The impacted element is the function uploadFile of the file controllers/pic.php. Such manipulation of the argument outerSrc/selectPhoto leads to cross site s…

  38. 2.0CVE-2026-86667EPSS 0.3%

    A weakness has been identified in aircheng-org iWebShop-5 up to 5.15. The affected element is the function member_list of the file controllers/member.php. This manipulation of the argument Search causes sql injection. The attack is possibl…

  39. 7.2CVE-2026-84387EPSS 1.6%

    An Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability [CWE-77] vulnerability in Fortinet FortiSandbox 5.2.0, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.…

  40. 9.8CVE-2026-79570EPSS 0.5%

    mfish-nocode-pro v1.0.0 was discovered to contain a SQL injection vulnerability in the tableName parameter at /sys/dbConnect/data. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement.

  41. 9.8CVE-2026-79569EPSS 0.5%

    Movie_Recommend v1.0.0 was discovered to contain a SQL injection vulnerability in the sort parameter at /loadingmore. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement.

  42. 9.3CVE-2026-78997EPSS 0.4%

    UC Browser for Android (package com.UCMobile.intl, version 13.7.8.1314) contains a Universal Cross-Site Scripting vulnerability that allows an attacker to execute arbitrary JavaScript in the context of any origin. An attacker hosts a speci…

  43. 5.4CVE-2026-52307EPSS 0.3%

    An authenticated stored cross-site scripting (XSS) vulnerability in the Column Management component of ClassCMS 1CMS v5.6 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the title field.

  44. 9.3CVE-2026-86738EPSS 0.5%

    Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to incomplete sanitization that reverses HTML encoding on greater-than and double-quote characters. Superusers can plant malicious CSS payload…

  45. 8.6CVE-2026-86733EPSS 0.6%

    Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/MariaDB command-line client (`mysql`) without the --binary-mode flag, so the client interprets lines beginning with backslash commands such…

  46. 8.7CVE-2026-86732EPSS 0.9%

    Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index endpoint that allows authenticated content editors to instantiate arbitrary classes through the criteria parameter. Attackers can inject a…

  47. 8.7CVE-2026-86730EPSS 0.7%

    Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allowing authenticated control-panel users to inject Yii2 behavior attachments and event handlers. Attackers can post field-layout tab elements …

  48. 9.8CVE-2026-79574EPSS 0.7%

    An issue in the gateway server of mpush v0.8.1 allows attackers to execute arbitrary code via sending a crafted broadcast message.

  49. 6.5CVE-2026-79573EPSS 0.4%

    L-ONE v1.0.0 was discovered to contain multiple SQL injection vulnerabilities in the /attachment/getBusinessUploadList component via the busid, id, and taskid parameters. This vulnerability allows attackers to access sensitive database inf…

  50. 7.5CVE-2026-78837EPSS 0.4%

    A SQL injection vulnerability in the ap_form_{id} parameter in AppNitro MachForm v30 allows attackers to access sensitive database information via a crafted SQL statement.